chore(deps): bump packaging from 23.2 to 26.2 - #4067
Conversation
dependabot
Bot
added
dependencies
![codescene-delta-analysis[bot]](https://avatars.githubusercontent.com/in/53921?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
🔍 Dependency Analysis Summary
Single dependency, spanning 7 releases (24.0, 24.1, 24.2, 25.0, 26.0, 26.1, 26.2). Overall risk: 🟢 LOW — OCS touches only 📋 Detailed Changelog ReviewPackage: Breaking changes in the release history
Every behaviour change in this span lands in Security fixesNone disclosed in this span — no CVEs, no GHSA advisories. This is a maintenance/feature upgrade, not a security bump. 🎯 Notable: 26.2 is specifically the right target in the 26.x series25.0 removed the Landing on 26.0 or 26.1 would have carried that pickle regression; 26.2 does not. Worth noting since OCS runs Celery — though the default serializer is JSON, so no New features (informational)
|
| File | Usage |
|---|---|
apps/channels/widget_versions.py:15 |
Version, InvalidVersion — widget version policy, deprecation/sunset, auth-level gating |
apps/channels/migrations/0029_experimentchannel_required_auth_level.py:4 |
Version, InvalidVersion — data migration grandfathering widget auth levels |
tasks.py:11 |
Version — inv Node.js minimum-version check |
All three do the same three things: construct Version, compare with </>=, catch InvalidVersion. No SpecifierSet, no Requirement, no Marker, no packaging.metadata, no private APIs anywhere in apps/, config/, scripts/, libs/, or tasks.py.
Verification performed
1. Differential behaviour fingerprint. Ran 39 version strings (real widget versions 0.4.2–0.11.0, pre-releases, epochs, local versions, post/dev releases, plus the malformed inputs OCS deliberately feeds in: "unknown", "", "latest", "not-a-version", whitespace-padded) through both 23.2 and 26.2, capturing parse result, normalised str(), and all 528 pairwise </==/> comparisons:
23.2 → 5e408a72caaa0800e02a8da23f1217c887182fdb1feb0af60b5101c90966c971
26.2 → 5e408a72caaa0800e02a8da23f1217c887182fdb1feb0af60b5101c90966c971
Byte-identical. Notably "unknown" still raises InvalidVersion — the sentinel that _parse() and migration 0029 rely on to grade a widget as AUTH_LEVEL_NONE.
2. Removed-API sweep across the installed tree. No third-party package imports packaging._structures, LegacyVersion, LegacySpecifier, or format_full_version from the real packaging. The apparent hits are vendored private copies (pandas/util/version, numpy/_utils/_pep440, pyarrow/vendored/version), comments (google/cloud/bigquery/_versions_helpers.py), or unrelated words (prompt_toolkit → data_structures). packaging._structures is in fact still shipped in 26.2 as the pickle-compat shim.
3. Import smoke test under 26.2. transformers, huggingface_hub, langchain_core, langchain_classic, celery, pandas, sentry_sdk, openai, anthropic, pydantic, django, rest_framework, markitdown, numpy, pyarrow, djlint, google.cloud.bigquery — all import cleanly.
4. Lockfile consistency. uv lock --check passes (296 packages resolved, no drift). No package in the tree caps packaging, so the >=26.2 floor resolves without conflict.
5. Python compatibility. packaging 26.2 declares Requires-Python: >=3.8; OCS requires 3.13+. No conflict.
Test impact: none expected. apps/channels/tests/test_widget_versions.py and test_widget_auth_level_ratchet.py are the tests that exercise this surface; given the identical fingerprint they should pass unchanged. SECRET_KEY/Postgres available to the review sandbox) — please confirm via the CI run rather than treating point 1 as a substitute for green tests.
Configuration changes: none.
🛠️ Recommendations
Action required: none. Merge once CI is green.
Testing focus (all low-probability, listed for completeness):
- Widget version policy: deprecation badges,
Deprecation/Sunset/Linkheaders onx-ocs-widget-versiontraffic, and theAUTH_LEVEL_*gating inlevel_for_version(). uv run inv runserver— exercises the_check_node_versionpath intasks.py.- Migration 0029 needs no attention: it is already applied, and this upgrade does not change how it would grade any version string.
Follow-up (optional nit, non-blocking): packaging>=26.2 in pyproject.toml is a much stricter floor than OCS needs. The only APIs used — Version and InvalidVersion — have been stable since well before 20.0. Dependabot raises the floor to the new version mechanically; a looser floor (>=23.2, i.e. a lock-only bump) would keep resolver headroom for any future co-installed package that caps packaging. Nothing in the tree caps it today, so this costs nothing right now — worth considering as a Dependabot config preference (versioning-strategy: lockfile-only / increase-if-necessary) rather than a change to this PR.
Merge recommendation: ✅ APPROVE
Rationale: three usage sites, all on the single most stable API in the library; every breaking change in the 23.2→26.2 span lands in modules OCS does not import; behaviour verified byte-identical on the exact inputs OCS feeds in; and 26.2 is the release that resolves the 25.0-era pickle regression rather than carrying it.
📚 Useful Links
- packaging CHANGELOG
- Full comparison 23.2…26.2
- packaging 26.2 release notes · 26.1 · 26.0
- Pickle-safety fixes: #1163, #1168, #1170, #1171
- packaging documentation · PyPI
- OCS widget versioning guide:
docs/developer_guides/widget_versioning.md
🤖 Automated Dependabot review by Claude Code
4603716 to
2bc57a7
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
🔍 Dependency Analysis Summary
Overall risk: LOW Two things that keep this small despite the version jump:
📋 Detailed Changelog ReviewPackage: Key changes — the bulk of this range is new surface area OCS does not touch: PEP 751 pylock support, Breaking changes in the range (all confined to modules OCS never imports):
Security fixes: none announced in this range. Migration notes: none applicable to how OCS uses the library. Worth noting that 26.2 specifically is the right landing spot: 26.0/26.1 broke pickling of
|
Bumps [packaging](https://github.com/pypa/packaging) from 23.2 to 26.2. - [Release notes](https://github.com/pypa/packaging/releases) - [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst) - [Commits](pypa/packaging@23.2...26.2) --- updated-dependencies: - dependency-name: packaging dependency-version: '26.2' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
2bc57a7 to
761455b
Compare
🔍 Dependency Analysis SummaryOne Python dependency changed; no JS/TS changes.
Overall risk: LOW. The version jump looks alarming, but OCS touches only two symbols from this library, and I verified their behaviour is byte-identical across the two versions rather than inferring it from the changelog. 📋 Detailed Changelog ReviewPackage: Breaking changes / behaviour adaptations across the range (none of which OCS is exposed to — see Impact):
Security fixes: none in this range — no CVEs, no advisories. This is a maintenance/feature bump. Migration notes: none required for OCS. Worth noting the 26.2 pickle fix cuts the other way: do not downgrade this PR to 26.0 or 26.1, which carry the pickle regression. 26.2 is the correct landing point.
|
|
@claude please create a new PR to address this followup item: Follow-up (optional nit, non-blocking): packaging>=26.2 in pyproject.toml is a much stricter floor than OCS needs. The only APIs used — Version and InvalidVersion — have been stable since well before 20.0. Dependabot raises the floor to the new version mechanically; a looser floor (>=23.2, i.e. a lock-only bump) would keep resolver headroom for any future co-installed package that caps packaging. Nothing in the tree caps it today, so this costs nothing right now — worth considering as a Dependabot config preference (versioning-strategy: lockfile-only / increase-if-necessary) rather than a change to this PR. |
|
Claude finished @snopoke's task in 3m 44s —— View job • Follow-up PR created: #4087
→ #4087 chore(deps): stop Dependabot ratcheting uv dependency floors What it doesThree lines of substance across three files: # .github/dependabot.yml (uv ecosystem)
+ versioning-strategy: "increase-if-necessary"# pyproject.toml
- "packaging>=26.2",
+ "packaging>=23.2",# uv.lock (root requires-dist only — resolved version stays 26.2)
- { name = "packaging", specifier = ">=26.2" },
+ { name = "packaging", specifier = ">=23.2" },Why
|
Dependabot's default versioning strategy raises the pyproject.toml floor to whatever version it just resolved, even when the code works fine on much older releases. dimagi#4067 is the example: it moved the floor to `packaging>=26.2` although OCS only uses `Version` and `InvalidVersion`, stable since well before 20.0. Mechanically-raised floors cost resolver headroom — they make the project unresolvable alongside any future co-installed package that caps the dependency, for no benefit. Set `versioning-strategy: increase-if-necessary` on the uv ecosystem so Dependabot updates uv.lock alone and only edits pyproject.toml when the new version genuinely falls outside the declared constraint. `increase-if-necessary` rather than `lockfile-only` so intentionally pinned or capped deps (`pyTelegramBotAPI==4.12.0`, `Django<6`, `django-oauth-toolkit<4.0.0`) can still be updated — `lockfile-only` would freeze them out of updates entirely. Also restore the `packaging` floor to `>=23.2` (its value before dimagi#4067). The resolved version in uv.lock stays 26.2. Co-authored-by: Simon Kelly <249606+snopoke@users.noreply.github.com>
1 participant
Bumps packaging from 23.2 to 26.2.
Release notes
Sourced from packaging's releases.
... (truncated)
Changelog
Sourced from packaging's changelog.
... (truncated)
Commits
84a87eeBump for release4a616b6docs: a few more updates to prepare for 26.2 (#1176)9de6f44ci: use native uv integration in rtd (#1175)bc76e14chore: update changelog for 26.2 (#1161)3f00091tests: add a pickle check (#1174)48a8a06fix: make Requirements/Markers pickle-safe (#1171)823b44efix: make Tags pickle-safe (#1170)4bed32dfix: make Specifier / SpecifierSet pickle-safe (#1168)963118efix: re-export ExceptionGroup for now (#1164)66e34a8docs(specifiers): add is_unsatisfiable() usage example (#1166)